MB-d2163881879a6d74f06b7a4e0a910c118721ffecedd0986c6c5a164808ee55ae
high
📛 Threat Title
Mirai: iran.sparc
Description
File type: elf. Size: 43832 bytes. Tags: elf, Mirai. Reporter: abuse_ch. First seen: 2026-09-19 05:58:29.
Indicators of Compromise (3)
Each indicator is enriched from the IOC database, threat-intel feed corroboration (Threat Hunt) and VirusTotal. Click one to expand.
hash_sha256
d2163881879a6d74f06b7a4e0a910c118721ffecedd0986c6c5a164808ee55ae
IOC database
- Type
- hash_sha256
- Value
d2163881879a6d74f06b7a4e0a910c118721ffecedd0986c6c5a164808ee55ae- First seen
- Last seen
- Attached to this threat
- Appears in
- 2 threats
- Description
- URLhaus payload hash attributed to Mirai
Threat Hunt — feed corroboration
Not present in any configured threat-intel feed.
Details From VirusTotal
No VirusTotal details cached for this IOC. Open the IOC page to query VirusTotal.
hash_md5
4673182e9b9f16fcb9b4cf7b0b3dd5fd
IOC database
- Type
- hash_md5
- Value
4673182e9b9f16fcb9b4cf7b0b3dd5fd- First seen
- Last seen
- Attached to this threat
- Appears in
- 2 threats
- Description
- URLhaus payload hash attributed to Mirai
Threat Hunt — feed corroboration
Not present in any configured threat-intel feed.
Details From VirusTotal
No VirusTotal details cached for this IOC. Open the IOC page to query VirusTotal.
hash_sha1
d795f46df86e9fd859398d5f08c59855a8ea68df
IOC database
- Type
- hash_sha1
- Value
d795f46df86e9fd859398d5f08c59855a8ea68df- First seen
- Last seen
- Attached to this threat
- Appears in
- 1 threat
Threat Hunt — feed corroboration
Not present in any configured threat-intel feed.
Details From VirusTotal
No VirusTotal details cached for this IOC. Open the IOC page to query VirusTotal.
References (1)
-
MalwareBazaar sample page
Abuse.ch
File type: elf. Size: 43832 bytes. Tags: elf, Mirai. Reporter: abuse_ch. First seen: 2026-09-19 05:58:29.
Remediations (10)
-
web:any.run
Mirai is a self-propagating malware that scans the internet for vulnerable IoT devices and infects them to create a botnet. Mirai variants utilize lists of common default credentials to gain access to devices. Mirai's primary use is for launching distributed denial-of-service (DDoS) attacks, but it has also been used for cryptocurrency mining.
-
web:en.wikipedia.org
Mirai (from the Japanese word for "future", 未来) is malware that turns networked devices running Linux into remotely controlled bots that can be used as part of a botnet in large-scale network attacks.
-
web:maltiverse.com
iran.sparc is a malicious file sample. Reported by 1 threat source, last seen 2026-09-05. IoC context and downloadable threat intel on Maltiverse.
-
web:threatfox.abuse.ch
Anonymous Http Payload Delivery On Port 80 At 103.83.87.122 Bash Script Dropper "telnet.sh" Downloads All Binaries with the prefix iran.arch and chmod 777 * then executes them with the string "telnet" indicating The Dropper Script Is Intended Use For Telnet Bruted Devices Such As Routers , Dvrs , Servers
-
web:thrivenextgen.com
2.1 The Iran Conflict: Strategic Cyber Implications The current military conflict involving Iran has fundamentally altered the cyber threat landscape across the Middle East and globally. Historically, Iranian military pressure has been directly coupled with escalated cyber operations — Iran's APT ecosystem functions as an instrument of state power, enabling asymmetric retaliation ...
-
web:urlhaus.abuse.ch
Payload delivery The table below documents all payloads that URLhaus retrieved from this particular URL.
-
web:urlhaus.abuse.ch
Payload delivery The table below documents all payloads that URLhaus retrieved from this particular URL.
-
web:www.joesandbox.com
Malware Analysis System Evasion Uses the "uname" system call to query kernel version information (possible evasion) Source: /tmp/iran.sparc.elf (PID: 6211) Queries kernel information via 'uname': Jump to behavior May try to detect the virtual machine to hinder analysis (VM artifact strings found in memory)
-
web:www.joesandbox.com
General Information Joe Sandbox version: 44.0.0 Smoke Quartz Analysis ID: 1922873 Start date and time: 2026-06-04 12:46:16 +02:00 Joe Sandbox product: CloudBasic Overall analysis duration: 0h 10m 37s Hypervisor based Inspection enabled: false Report type: full Cookbook file name: defaultlinuxfilecookbook.jbs Analysis system description: Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0 ...
-
web:www.meforum.org
Iran's retaliation playbook activated within hours: ballistic missiles struck at U.S. bases across the Gulf and at Israeli territory, Hezbollah opened fire from Lebanon, intelligence detected Houthi preparations from Yemen, and Iranian cyber forces degraded their own population's internet access.
AI Forensic Analysis
Only Available for Registered Users. Sign in to view.